The vulnerability is a missing authorization flaw in the Marcin Wise Chat WordPress plugin, allowing attackers to bypass configured security levels and access privileged functions. This can grant unauthorized users control over chat features or data. The weakness is identified by CWE‑862, signifying insufficient authorization controls.

Affected systems include installations of the Marcin Wise Chat plugin version 3.4.3 and earlier on WordPress sites. All deployments of the plugin up to and including 3.4.3 are potentially vulnerable.

Severity is scored at CVSS 7.1, indicating a moderate to high risk. The EPSS score is less than 1%, suggesting very low but nonzero exploitation probability, and the vulnerability is not listed in the KEV catalog, implying no known active exploitation at the time of analysis. Exploitation would likely involve sending crafted requests to plugin endpoints from a web context, potentially without authentication, and would require the plugin to be enabled on the site.